Troubleshooting Tip : Viewing FortiGate log entries from the CLI

[rmetzger]

Description

This article describes how to view log entries from the FortiGate CLI.

Scope

All FortiOS versions.

Solution

It is assumed that Memory and/or Disk/Faz/FDS logging is enabled on the FortiGate and other log options enabled (at Protection Profile level for example).

1. Setup filter(s) for the logs to be displayed

FGT# execute log filter device 1	Available devices: 0: memory 1: disk 2: fortianalyzer 3: fortianalyzer-cloud 4: forticloud
FGT# execute log filter category 3	Available categories:  0: traffic 1: event 2: utm-virus 3: utm-webfilter 4: utm-ips 5: utm-emailfilter 7: utm-anomaly 8: utm-voip 9: utm-dlp 10: utm-app-ctrl 12: utm-waf 15: utm-dns 16: utm-ssh 17: utm-ssl 19: utm-file-filter 20: utm-icap 22: utm-sctp-filter 23: forti-switch NOTE: Some categories may not be available on some FortiOS versions.
FGT# execute log  filter view-lines 100	To define the number of lines to display
Other available filter options	FGT # execute log filter ? category              Category. device                Device to get log from. dump                  Dump current filter settings. field                 Filter by field. free-style            Filter by free-style expression. ha-member             HA member. local-search-mode     local log search mode max-checklines        Maximum number of lines to check. pre-fetch-pages       Number of pages to check in advance under on-demand log search mode. reset                 Reset filter. start-line            Start line to display. view-lines            Lines per view.

2. Check all filter settings

FGT# execute log  filter dump

category: webfilter
device: memory
roll: 0
start-line: 1
view-lines: 100

3. View the logs corresponding to the filter

FGT# execute log  display

1 logs found.
1 logs returned.

1: 2009-09-21 08:42:00 log_id=0314012288 type=webfilter subtype=content pri=warning fwver=040000 vd="root" policyid=1 serial=1437 user="N/A" group="N/A" src=10.160.1.10 sport=2061 src_int="port2" dst=x.y.z.t dport=80 dst_int="port1" service=http hostname="www.fortinet.com" profile="web" req_type=referral url="/products/" status=blocked agent="N/A" from="N/A" to="N/A" banword="Network" msg="URL was blocked because it contained banned word(s)."

Related Articles

Technical Tip : How to delete FortiGate log entries stored in memory or local disk